Open Bug 1501082 Opened 6 years ago Updated 2 years ago

StoreUserInteractionAsPermission can be forged by a rogue content process

Categories

(Core :: DOM: Security, enhancement, P3)

Product:
Core
Component:
DOM: Security
Type:
enhancement

Tracking

()

Project Flags:
Fission Milestone Future

People

(Reporter: tjr, Unassigned)

References

(Depends on 1 open bug, Blocks 1 open bug)

Details

(Whiteboard: [domsecurity-backlog2]) 

The PContent method StoreUserInteractionAsPermission accepts a principal from the content process and uses it to denote special permission bits indicating the user interacted with the page.

A rogue content process could supply whatever principal they wished; and use it to set permission bits. We should ensure the value is sane for the origins hosted by the content process.
Priority: -- → P3
Whiteboard: [domsecurity-backlog2]

This bug is not a Fission MVP blocker.

Fission Milestone: --- → Future
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.